             ;; default case
             (assert false (i18n/trs "unexpected message validation outcome")))
           (catch map? m
-            ;; This is a processing error, say an uncaught exception in
-            ;; any of the stuff we meant to do
+            (log-access :warn (assoc message-data :accessoutcome "PROCESSING_ERROR"))
             (send-error-message
               message
               (i18n/trs "Error {0} handling message: {1}" (:type m) (:message &throw-context))
               connection))))
       (catch map? m
+        (sl/maplog
+          [:puppetlabs.pcp.broker.pcp_access :warn]
+          (assoc (connection/summarize connection) :type :deserialization-failure
+                                                   :outcome "DESERIALIZATION_ERROR")
+          "{outcome} {remoteaddress} {commonname} unknown unknown unknown unknown unknown")
         ;; TODO(richardc): this could use a different message_type to
         ;; indicate an encoding error rather than a processing error
         (send-error-message nil (i18n/trs "Could not decode message") connection)))))

    (websockets-client/send! websocket (encode error-msg))
    nil))

;; NB(ale): using (s/Maybe Websocket) in the signature for the sake of testing
(s/defn process-message! :- (s/maybe Connection)
  "Deserialize, validate (authentication, authorization, and expiration), and

              nil)
            :to-be-processed
            (do
              (log-access :info (assoc message-data :accessoutcome "AUTHORIZATION_SUCCESS"))
              (let [uri (broker-uri broker)
                    capsule (capsule/add-hop capsule uri "accepted")]
                (if (= (:targets message) ["pcp:///server"])
